a5fe631717
## Changes ### Identity Provider (Authentik) - ✅ Deployed Authentik 2025.10.3 as identity provider - ✅ Configured automatic bootstrap with admin account (akadmin) - ✅ Fixed OIDC provider creation with correct redirect_uris format - ✅ Added automated OAuth2/OIDC provider configuration for Nextcloud - ✅ API-driven provider setup eliminates manual configuration ### Nextcloud Configuration - ✅ Fixed reverse proxy header configuration (trusted_proxies) - ✅ Added missing database indices (fs_storage_path_prefix) - ✅ Ran mimetype migrations for proper file type handling - ✅ Verified PHP upload limits (16GB upload_max_filesize) - ✅ Configured OIDC integration with Authentik - ✅ "Login with Authentik" button auto-configured ### Automation Scripts - ✅ Added deploy-client.sh for automated client deployment - ✅ Added rebuild-client.sh for infrastructure rebuild - ✅ Added destroy-client.sh for cleanup - ✅ Full deployment now takes ~10-15 minutes end-to-end ### Documentation - ✅ Updated README with automated deployment instructions - ✅ Added SSO automation workflow documentation - ✅ Added automation status tracking - ✅ Updated project reference with Authentik details ### Technical Fixes - Fixed Authentik API redirect_uris format (requires list of dicts with matching_mode) - Fixed Nextcloud OIDC command (user_oidc:provider not user_oidc:provider:add) - Fixed file lookup in Ansible (changed to slurp for remote files) - Updated Traefik to v3.6 for Docker API 1.44 compatibility - Improved error handling in app installation tasks ## Security - All credentials stored in SOPS-encrypted secrets - Trusted proxy configuration prevents IP spoofing - Bootstrap tokens auto-generated and secured ## Result Fully automated SSO deployment - no manual configuration required! 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
83 lines
3 KiB
YAML
83 lines
3 KiB
YAML
---
|
|
# Install and configure Nextcloud apps
|
|
|
|
- name: Install Collabora Office app (richdocuments)
|
|
shell: docker exec -u www-data nextcloud php occ app:install richdocuments
|
|
register: collabora_install
|
|
changed_when: "'richdocuments installed' in collabora_install.stdout"
|
|
failed_when: collabora_install.rc != 0 and 'already installed' not in collabora_install.stdout
|
|
when: collabora_enabled | default(true)
|
|
|
|
- name: Enable Collabora Office app
|
|
shell: docker exec -u www-data nextcloud php occ app:enable richdocuments
|
|
when: collabora_enabled | default(true)
|
|
changed_when: false
|
|
|
|
- name: Configure Collabora WOPI URL
|
|
shell: |
|
|
docker exec -u www-data nextcloud php occ config:app:set richdocuments wopi_url --value="https://{{ collabora_domain }}"
|
|
when: collabora_enabled | default(true)
|
|
changed_when: true
|
|
|
|
- name: Get Nextcloud internal network info
|
|
shell: |
|
|
docker inspect nextcloud-internal -f {% raw %}'{{ .IPAM.Config }}'{% endraw %}
|
|
register: nextcloud_network
|
|
changed_when: false
|
|
when: collabora_enabled | default(true)
|
|
|
|
- name: Configure Collabora WOPI allowlist
|
|
shell: |
|
|
docker exec -u www-data nextcloud php occ config:app:set richdocuments wopi_allowlist --value="172.18.0.0/16,172.21.0.0/16"
|
|
when: collabora_enabled | default(true)
|
|
changed_when: true
|
|
|
|
- name: Install two-factor authentication apps
|
|
shell: docker exec -u www-data nextcloud php occ app:install {{ item }}
|
|
loop:
|
|
- twofactor_totp
|
|
- twofactor_admin
|
|
- twofactor_backupcodes
|
|
register: twofactor_install
|
|
changed_when: "'installed' in twofactor_install.stdout"
|
|
failed_when: twofactor_install.rc != 0 and 'already installed' not in twofactor_install.stdout
|
|
|
|
- name: Enable two-factor authentication apps
|
|
shell: docker exec -u www-data nextcloud php occ app:enable {{ item }}
|
|
loop:
|
|
- twofactor_totp
|
|
- twofactor_admin
|
|
- twofactor_backupcodes
|
|
changed_when: false
|
|
|
|
- name: Enforce two-factor authentication
|
|
shell: |
|
|
docker exec -u www-data nextcloud php occ config:system:set twofactor_enforced --value="true" --type=boolean
|
|
when: twofactor_enforced | default(true)
|
|
changed_when: true
|
|
|
|
- name: Configure APCu for local caching
|
|
shell: |
|
|
docker exec -u www-data nextcloud php occ config:system:set memcache.local --value="\\OC\\Memcache\\APCu"
|
|
changed_when: true
|
|
|
|
- name: Configure maintenance window
|
|
shell: |
|
|
docker exec -u www-data nextcloud php occ config:system:set maintenance_window_start --value=2 --type=integer
|
|
changed_when: true
|
|
|
|
- name: Display apps configuration summary
|
|
debug:
|
|
msg: |
|
|
Nextcloud Apps Configured:
|
|
- Collabora Office: {{ 'Enabled' if collabora_enabled else 'Disabled' }}
|
|
WOPI URL: https://{{ collabora_domain if collabora_enabled else 'N/A' }}
|
|
- Two-Factor Auth: {{ 'Enforced' if twofactor_enforced else 'Optional' }}
|
|
- TOTP (Authenticator apps)
|
|
- Admin enforcement
|
|
- Backup codes
|
|
- Caching:
|
|
- Local: APCu
|
|
- Distributed: Redis
|
|
- Locking: Redis
|
|
- Maintenance window: 2:00 AM
|